dd9979d21eabb6d6579af907c1d95006fe097db115aea4c6c1bb4cfb27224e9f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd9979d21eabb6d6579af907c1d95006fe097db115aea4c6c1bb4cfb27224e9f.exe
Size 1.2MB
Sample260814-k48eaazdkc
SHA256 dd9979d21eabb6d6579af907c1d95006fe097db115aea4c6c1bb4cfb27224e9f
MD5 e26e582ad1732387ce8b4c9cff420eb3
SHA1 7379325b95006c88b2a74ed76e34cd48527b9824
SHA512 52391254e592314dd601c26d3ee3b533b27155238a885d9397adfd0567d2c326847cb41e956692d0960def2f123f6a81f1809c657daf8e7f72715c1933c2a123
SSDEEP 24576:ijBp89TR3AfE/FdppQT9gdR3d/7QraLgjJbTojcVtA54TBzRV:ijBiAfE/TppQT9kpd/7QhjJbbPAST
TLSH
T11F45234A27D57062ECF9137894F286D7EA7070A18B3C11FF36C585BD0E626D1AB32B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1580 created 3332	1580	Fed.scr	56

Executes dropped EXE 1 IoCs

pid	Process
1580	Fed.scr

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dd9979d21eabb6d6579af907c1d95006fe097db115aea4c6c1bb4cfb27224e9f.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4048	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5080	cmd.exe
1876	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fed.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3040	schtasks.exe
4020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1580	Fed.scr
1580	Fed.scr
1580	Fed.scr

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 3004	1468	dd9979d21eabb6d6579af907c1d95006fe097db115aea4c6c1bb4cfb27224e9f.exe	85
PID 1468 wrote to memory of 5080	1468	dd9979d21eabb6d6579af907c1d95006fe097db115aea4c6c1bb4cfb27224e9f.exe	87
PID 5080 wrote to memory of 4048	5080	cmd.exe	90
PID 5080 wrote to memory of 1992	5080	cmd.exe	91
PID 5080 wrote to memory of 4444	5080	cmd.exe	93
PID 5080 wrote to memory of 4524	5080	cmd.exe	94
PID 5080 wrote to memory of 1580	5080	cmd.exe	95
PID 1580 wrote to memory of 1876	1580	Fed.scr	96
PID 1876 wrote to memory of 3040	1876	cmd.exe	98
PID 1580 wrote to memory of 4020	1580	Fed.scr	99

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3004	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\dd9979d21eabb6d6579af907c1d95006fe097db115aea4c6c1bb4cfb27224e9f.exe
  "C:\Users\Admin\AppData\Local\Temp\dd9979d21eabb6d6579af907c1d95006fe097db115aea4c6c1bb4cfb27224e9f.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SYSTEM32\attrib.exe
    attrib.exe
    3⤵
    - Views/modifies file attributes
    PID:3004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c move Requested.sldx Requested.sldx.bat && Requested.sldx.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4048
  - - C:\Windows\system32\findstr.exe
      findstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"
      4⤵
      PID:1992
  - - C:\Windows\system32\extrac32.exe
      extrac32 /Y Husband.sldx *.*
      4⤵
      PID:4444
  - - C:\Windows\system32\findstr.exe
      findstr /V "Production" Greatest
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\308624\Fed.scr
      Fed.scr o
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "SophiaRift" /tr " pcalua.exe -a 'C:\Users\Admin\AppData\Local\CloudShift Innovations\SophiaRift.lnk'" /sc onlogon /F /RL HIGHEST
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Chaos" /tr " pcalua.exe -a 'C:\Users\Admin\AppData\Local\CloudShift Innovations\SophiaRift.lnk'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Chaos" /tr " pcalua.exe -a 'C:\Users\Admin\AppData\Local\CloudShift Innovations\SophiaRift.lnk'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3040

C:\Windows\system32\pcalua.exe
pcalua.exe
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fed.scr

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\308624\Fed.scr
Size 957KB
SHA256 3ec9740bedc683021cc3e94e4a33b3a9d3d6f9b9e96b1f04cc6534f551dd58c1
MD5 f589c1095824c52a5ed3625d0d851b22
SHA1 2eac026b394548268cc8ee783de99c88cfb1e408
SHA512 f47f3bf4930191eb0d01b1a1bd737ccbe368266c99d5ee1c22d7db49125d7b3ca0685fb2c057f891e9240d215ddb96209db2e971c640592e1d487e794cc93e46
SSDEEP 24576:hMd+PsPy8Fv7yw56uX4Nw1ImcY3a2hrbBz:hzPsPy8Yw5EN62srb
TLSH
T19E259E0373D18022FF93AA721D5FE7265ABC6D2A0323956F13D81EB5F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\308624\o
Size 592KB
SHA256 ea281a185885be2b906e71e0620114b0cf86d429c4253d8d9528bfb32a0f5ef5
MD5 6f11acc2ca33a9705c72e4770cba8116
SHA1 77c27732f428f0f7c053a7d7ecd1d4ff55768e99
SHA512 1c96bb35d4f70efd31036698e30b966916543dceb87fa8bb00e24804453e7caf716cccf3b81bbbd8a326ed9284860246c2b4ccc37452fec5daa080c0d3617755
SSDEEP 12288:VjhzAFpoiqlP31jKOTOEUjtHZ4wneH+RjOreUpFjr/DQb3SvDOF+7PwoTKFCwLUC:L7FjJStt54dTy8jTE3SjxpC
TLSH
T142D4236FF50776002DFD054CA8DE4BFABAE04061DE3F9C6A39D50D8930AD7169B928D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acute.sldx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Acute.sldx
Size 262KB
SHA256 cf2b49ea6508a7c308613fa9b7c130915668f216c72589d0beecc6ec5f7c88b8
MD5 559d90bac4c27b152a62b95ff3182835
SHA1 3c02c71fe423f6aa34a58a09f1ee5319e13c227c
SHA512 fc8aa97d90ae021b2de21c65194dc86946419f4644cd263c7b468ea0e0894f6363b3ff977fd1f8a4501a7c980243b3fa3eb063e6081aa8fe5a881f3a9f1a3f51
SSDEEP 6144:r2Qwshz3QpWypVc3iqz5Pkq1jzW8KQbD4IOEUjRLR9Z4Fbau3UeHF:VjhzAFpoiqlP31jKOTOEUjtHZ4wneHF
TLSH
T1FE44239DE407B4210DAA00D97ADC43FD7FA0A0A0DE3E7D77B19A197678E8E48AF510D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Basis

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Basis
Size 100KB
SHA256 735ac0bc3f9d8c97d372bec91860cbcb775432b5f0737b44b042d63ce4a1340a
MD5 b853568f97cd19bc20f6d26f6c4e166b
SHA1 5d407cbb28e096f7821f1ae4679d47eaf059124e
SHA512 679459ede91dbfea2bbd72e5492cba96dd1c8b65ce0ff777b71b2f945cf0ed6d795480d467c647abb0eea939f3753afd7ddc7bc22f1eec94b78ab19935333434
SSDEEP 1536:T1HOyU/CX2CdXibOT0EdQGQ9EtSijtNOKc+48918JsdVCsESNvmtpAi6JvAp:s/CfXib+tSijpcVMFXD5ypAXop
TLSH
T1E9A39E536583005BCBA312709D0FBA3ABAFADD2B0138D59653C85CB9B7D2495B50F3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bedford

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bedford
Size 137KB
SHA256 16c0ba861550db9ef29c56126cda48c4ea5de110f17823bf767ec0ccf0cd1c63
MD5 f2c385b4a303327d9d1a40475e0eabab
SHA1 fdecc2dd858e7ff34b20c889fcbc704ef822b0f6
SHA512 cebef3e1ebec13aba798b0f393c38cb5f1a3d12df9952ded1b59dd56648df334a74d1c9ebbee317d40b2a1a5c034eb5850f4eadd76559c9c8613070f1a090f5d
SSDEEP 3072:cYbwR5Exe2/RTX/4gxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYv4:5wc7/RTggXuN2KFIyt+8ZU4
TLSH
T1EDD38E41ACE1D272C9272C705CB5EB65597C9C700B19AEDF73C809B3DE60AC64F24E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cases

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Cases
Size 35KB
SHA256 b3c0e8cac754d3cbd360753d819c5e46fdc732b4f11ec52d3081edeb47160042
MD5 329844ec72959ac15f86ea2818eb5bf6
SHA1 6eb3ecfdf2d827c063e178f424dc5d7ad0a0870d
SHA512 d1455da3fb907d1224966599dd4a94b8f129c401fe33e6baf0f7a86ae8dacab4fceadf5d36f11cc602daa0ff0f995e40b9e3a21ac32b300bc34464e1dfec3979
SSDEEP 768:NOTGQfoz66t4dP+8pN5XvrsY916ojfvSb2Tal0xiVWV9+k:QTG62rt4dP+iX7DjfvSSuyxiQ
TLSH
T12AF2AF7A5E355967DD688CFDA2CCBF169DFC93E2D9DE006B901242D825023A13AD490F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Counts

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Counts
Size 60KB
SHA256 1b346a896dbc57584ea07d502d883ef8a52fb1a6621f007ce1db43e88051f76d
MD5 5f8c2d790631a6701f89f026e77ae24c
SHA1 3e40b246e15364b027ba04a83ec481f3a0e65949
SHA512 5ea32acd2e1872c316a88d77f8d484b54c8f203fea33e8f811adb8e45e274de4e5a7a78950901490b69e6de2b6415c2961e94cad42f43b4ec6b885550a4c06ed
SSDEEP 768:D3d7Xu68cFrPM08smqbe8wab/sFtKJeVnXiAwsCgh4WcnZgLaxXJTyxOf87M4os8:TR+68cNk3smxUsb1yAwsc8MxqVbDu
TLSH
T1E4534B33B0D22084DDE70AF12D1BAB97AD78D8164034AC865ACA7EBDDE559316B0F7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Faith

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Faith
Size 82KB
SHA256 058809a9a5a19b362653675df07c4309550c9b0bf2d4ddcb6515998023649676
MD5 6912685116261f6fe2094289565ba9d4
SHA1 b255f4a188c09cef959c3c6247f8834f220c64f1
SHA512 43be96d3b63c44aa91b1170d3f74b155140ba8359e8836635d6734ee2ee8b608cc823dabda2c99b7cb9debbd9921d320e863af4f0cbced15e09d6c147cd9d159
SSDEEP 1536:onCIj4BZKaTb1nXu4uuVGHj1vtKsevk+goJqvtmgMbFuz08QuklMBNIa:oCIj4BPb1XuE/gc0Ag0Fuz08XvBNf
TLSH
T142831801B1FBB8E7D8B276F44FE9CAD99637B8694272443F13F8160F9EA16004E52671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greatest

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Greatest
Size 107B
SHA256 65a9514a854a0e0a827c29d35935dfac1cba1a62bdb16cb793dcefc478321a82
MD5 6f97a7c4a08ecf5a1d9f87103382f415
SHA1 8645e7e40d624b8ec78570c30be6bd9cac304ae4
SHA512 ff0aa3b61a3f362e891fec2cafba77fc765f5bac98710ffeded669690784e62dd6fcfe30f9bfef648dc4d5418dde6bce28248c8ce8846bdb8358cac3bb09cc40
TLSH
T187B0029976D3E899D40910B85313C9B86537B8159714AE832E84046FD8A156E5BCF24D
MD5 SHA1 SHA512 TLSH

Submit Download

Husband.sldx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Husband.sldx
Size 495KB
SHA256 fb7b827e5e3d3f723e031fdb73c5a96357fba9ae084493c6910d38a31188cc99
MD5 99314946c84560f1274219e90a640d65
SHA1 5146a25e2d47be119787b8a204b14ab1f3cc1723
SHA512 dc328b268c7908df1df9bbba917f4cf8bb344d30b31dc5fd132aa4925289afa531c645a853f71c24a32ca759e53bab1e90c0373ff1711941cc97c962983dcf81
SSDEEP 12288:y6w5zJc1VeQQ09gpSXQlAnr4hrYLguuq5DUTf:WNJcHQ09g+QGnEhrYLguJy
TLSH
T187B423923EA9A53F4DC273583197FED92D200387C95E312D2E67196B1AA343E7336C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Infections

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Infections
Size 90KB
SHA256 e9b1313f76aa07170c484f4c846de0fa1a541868ad8cfbfcda4db2ca3ea725dd
MD5 f46c848643baac561dc784b3c12ee3b1
SHA1 ff6ed0ee64f945888be9ff9571c48d03fff0b0ba
SHA512 7f2bb2434bfc5d100f86b1d57d5ab33bf1931724444c9aa427978ed1cfaea38a1f1161279a35292f7e11f100bcee40b5fd79c0881b2348ffc646053f8df6f653
SSDEEP 1536:4InT3VCLIsLS8ZIjOrOJ0ou3GerIUhj18Ehs5VqX25G5ClCQEiV2XaRodwTVCJ9o:4gz8StjOrOJGGMBwvqXQGYlawwBY
TLSH
T1D5935B037A420072CE6783B18D5DFB26B7EC4B2B0446E75B535F08F0BB52526A56E2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lexus

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Lexus
Size 117KB
SHA256 09ddd378332e46aeb9922e633ea3855783ff16686bdb5862548e1d34b65640f0
MD5 c9f892f0771e88fa00ae4c188b81b548
SHA1 81429f799e4c5b3b7ee128936f78aa86eb5920e7
SHA512 2fdb3a8a3a2dd418bd43340e68de215701842a3139fad14f4e26358bcf655bebe8722154983bf75706185910a0691a514e0b72205946a74504a5725d35cad5ac
SSDEEP 1536:/PuwaAwu+1PdJaGloaj6bs8jcd/TcI3s+uXkry:/vaAt+1Pfam6Ozmkry
TLSH
T1FDC31E0473B4C52AFFC7E5BB5792C2064BFA7A9E9543412F20606BBAB8703B0477D961
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mazda

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mazda
Size 87KB
SHA256 08efd509c6b1fc1e00a447ba536b3ec09a2b4bb9a8098fd62a289f8172c3d247
MD5 97f85e3633009adfd80260bef594317e
SHA1 cee2c267cdf1a815bf8e45503a49f6d185cbf065
SHA512 3b583d50e3d110abe773d2d84d2adf535ae6fde41d4d5ac5a17605712860305b4f4a763deda77be9316641ddfad224437116aec7ffd19a8a0a06698dde41cb78
SSDEEP 768:CXV7+/UrrR3T3oh63EYr8qcDP8WBosd0bHazf0Tye4Ur2+9BrKHDX:4hrRj3oh63EYrDWyu0uZo2+9Br+DX
TLSH
T1A1932B535AA90547E0B73A34747FE77F0A64BC5F5B34B63A035C3F8E9824A808869772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Representing.sldx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Representing.sldx
Size 180KB
SHA256 0a2e73bf5a41a8d975632617c7b934954b7a5967440da36e0e98c3fe19b8fa40
MD5 aa0fc24707e802a6de210b7d99779663
SHA1 b0943344c0380502abe6f2960b455e2cb073f0d8
SHA512 3edf4281bc21b8725f8ae3b2c97edf6305769b7881284b97a92f80e4dcc5501356beee4b5352da378ae04e0a2ef4c142b11932011a7df99f3f9939aacdb0c583
SSDEEP 3072:ezkcjuqU5EOJb+omGaap4kjwQ8IjR0uoKrq1QDNbar8w9P1NFWXCYNogCdSw5WQS:MRjFUrPmGrpFjHrqKD5ab3cZNW3YDF
TLSH
T1280423BFF617569839E8CD1898675A53E5E701623E36C8AC09F3408BB06A35359B2F4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Requested.sldx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Requested.sldx
Size 22KB
SHA256 fd15a09d74e0c0aa886ae64affda6e6d136fcc6a4e4c21fc62d243fa6ee39254
MD5 ebd9a6651d78b22242834905f621c285
SHA1 21c1e6ce40eae332f43d9ca2f30044d6062ad139
SHA512 1220fa45d8e6d562b987868db667cc0970620ba601e20133c87fa43757cf6cc39abdc8760a8d442ae760f3dbcf9e0ad352b4652c77bf956d784fe94a890ae9fc
SSDEEP 384:bmCGyQW0syM1AZQc50AEgyOnmUrhMkuvI/up6f7p+LIJN0m28:bOk/cmAEgthMkRuUpz28
TLSH
T102A23CF6BA9E89062787F6B75BE11DE58DB2D3551630222A6F5B09D6C2048081337F3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Robust.sldx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Robust.sldx
Size 150KB
SHA256 d1f2104be559711fa926d173f9778c5ac1c08979199d3ec43c147bb58a4754a1
MD5 8f5ddd46e5937c452f8c77205395c70d
SHA1 c1463e16cc23cfc6f845873de3c960291bcac194
SHA512 591bce107274929b4e67bc1908a9f4956d9bd75a6ff7026e40225ec8d7517b2fb8d427c3285769bdd35f2a717e9b95f9032111d2955549863ac9c9097431f78f
SSDEEP 3072:JqipzSyEuOI7PGY0nagBwTLMsl2EKFcbVXsKv+ToW3NSV0MuldlvBUC:MAS+7PGvNWQI9T5XsK43CwzBBUC
TLSH
T1EEE3122B79F37F052FAE269C885D9ED86460448AC1AE40847DD0ADC8031D625939EFFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Salad

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Salad
Size 77KB
SHA256 882ccc0d80da6bea73f5b717fcf6311ebaaa6486bd4c77e97b3a5c3e78df8c3a
MD5 ee149210b4dcaf7bcc7e0dcadae53763
SHA1 5e16f49dbaa377c9ff1a75796ef0f11b9151b9ed
SHA512 80e219d85415446eb2e05dd87f75cd7640915bd1ca68be72aa663a76b85f95dbebc340a14e564676786131114f1399873569ca31dbb535a1a97508920d40113e
SSDEEP 1536:Ft0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPc:ceVzOqD1IGuTpMgB
TLSH
T1A8738E52A4D0C1A4C6990D309C6DEB63AD7C8E1B03352DDBFBD90D326E65CE3A520D5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sensor

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sensor
Size 80KB
SHA256 74553be3e5332d674d82855a90a09d440a43208c70edee9ec87e6cf78bfb173c
MD5 03a7f66960a0ef821794c384535dfb76
SHA1 6874d93f140ccccdb9ce6291ecfee818bab45506
SHA512 c99a07f41b9c99d283d974faa5bb8a63c2dc3a1e21b7d02ba8fb5ac9836caae75672d6d1a7c8418bb5cafccfe6b4c2a825d0453b3ca0c57557543ac11eb083b0
SSDEEP 1536:ZnOM4O7tiC9jC0O2i94rqWJNm4Ql0/YUdzPrCtTRV5H4YL3KZ09kOJ9:ZnasL9jC0O2iSW4QlXUxPrCtTRVB4Y3L
TLSH
T1A6837C637B4200E7CE5353B1DD5DFA26B7A98B0E1528EB9A138C2CF4FB86407A55D087
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Switches

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Switches
Size 91KB
SHA256 addff0389fa7f228b6caed62af2b8b51fe4f327c3e07731e87582f38f91339a9
MD5 446261bc14d5c56f4ac25eb875fd62b7
SHA1 5bd39dd4eafc695024f9a0880d178d454a906544
SHA512 d2159ca115eeaca802c18d1fdd622409b7f228ce525afbf6a72441ad1e33077472d8245bffe73119d101f52af66a42b4e41e6862751653aa6c33df3b2be9dff5
SSDEEP 1536:1ohx6a+A3MDS661CZxbxY/jJHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZl+:ahx6vA3MD8jjJ8lghHzJi2ubSW4wC2m+
TLSH
T136938C45B0829036C8924871495BABE2AF3C963503249DCB5BED3D75EB701D0EFBB786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1580-83-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-77-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-78-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-79-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-80-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-82-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-84-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-86-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-76-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-85-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-94-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-95-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-89-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-93-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-92-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-91-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-96-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-90-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-88-0x0000000000870000-0x00000000008DF000-memory.dmp

Download

memory/1580-87-0x0000000000870000-0x00000000008DF000-memory.dmp

Download